After deleting all indexes using curl -XDELETE http://localhost:9200/_all
I tried to create index pattern again but when I clicked the create button, it didn't response and no index was created. How to fix this problem?
Index patterns do not create indices, you need to do that in Elasticsearch before Kibana can read them.
I found that there are still indices in elasticsearch. Are these indices constantly generated by elasticsearch from the logs sent from the beat agents?
However, when I clicked the create button, it stay the same with no index pattern created.
Also I found that there are many .hprof files taking a lot of disk space.
C:\Program Files\Elasticsearch\bin\java_pidXXXX.hprof
What are the files for? Can I delete them?
Where are the indices stored?
If I turn on all the beat agents on the logging machines to send logs to the ELK server, the log received will grow continuously. What the house keeping work to do?
Yes.
Check with _cat/indices please 
They are JVM heap dumps, which are not good. You may want to check your logs.
On the local disk.
Check out Elasticsearch Curator.
Can you see any thing wrong?
I can't find the index files? Are they .json files inside the logstash or elasticsearch folder? What is the exact path?
I'm a little lost, what problem are you trying to solve here?
I tried to add index pattern by command with the following errors. How to fix it?
C:\Script>curl -XPUT http://127.0.0.1:9200/.kibana/index-pattern/filebeat-* -d '
{"title" : "filebeat-", "timeFieldName": "@timestamp"}'
{"error":"Content-Type header [application/x-www-form-urlencoded] is not support
ed","status":406}curl: (7) Failed to connect to port 80: Connection refused
curl: (6) Could not resolve host: filebeat-,
curl: (6) Could not resolve host: timeFieldName
curl: (3) [globbing] unmatched close brace/bracket in column 11
I would like to know what is serving the web page? Why port 80 cannot be connected in this case?
It's probably easier if you do it via the Kibana UI.
But Kibana UI does not response. What wrong with it?
I am not sure how to do the following. Can provide a more detailed guide of how to execute the command?
1.Create a .kibana-6.1 index based on your existing mappings, but make sure type looks like:
"type": {
"type": "keyword"
},
2.Reindex from .kibana-6 into .kibana-6.1:
POST _reindex
{
"source": {
"index": ".kibana-6"
},
"dest": {
"index": ".kibana-6.1"
}
}
3.Realias
POST /_aliases
{
"actions" : [
{ "add": { "index": ".kibana-6.1", "alias": ".kibana" } },
]
}
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.